Friday, October 11, 2013

Find Operating System Start time using Powershell.


Today, I have been asked  to do a strange task, My manager told me to find a Operating System Start time.

I was thinking about an half hour  on how to get this done, then i thought about Event Logs, every thing is recorded there, after a few minutes of hardworking , i have found the event which tells us about the Start time of the Operating System.

He wants a history of  start up time of all dates, and luckily windows keep history of start up time in Event Logs.

The Event ID : 12, shows a information on at what time the Operating system was  started.


11-10-2013 17-23-24
and we know how to use Powershell and  how to use Get-EventLog cmdlet.
and then it a matter of few seconds , and I have the list of Operating System’s start time.
run the below command to get the list of start time of the operating system.

Get-EventLog -Log System  |  Where {  $_.EventID -eq 12    } | Select TimeGenerated


Here is the result.

11-10-2013 20-15-13
Happy Weekend. Have fun :) .

Thanks
Aman Dhally
clip_image001 clip_image002 clip_image003 clip_image005  clip_image007

2 comments:

  1. I might recommend WMI for this information. Event logs can be deleted after all.

    http://gallery.technet.microsoft.com/Multithreaded-System-Asset-856a8f7c

    Cheers,
    Zach

    ReplyDelete
    Replies
    1. Hi Ferreter

      Thanks for the comments,

      Yes we can use WMI too,

      Actually i depends on the environment, in Our we do event logs for a long time :) and these is always more then one way


      Thanks and Welcome to the blog.

      Thanks
      Aman

      Delete